How do shadow passwords improve the password security in comparison to standard no-shadow password?

Question

Options

• ARegular users do not have access to the password hashes of shadow passwords.
• BEvery shadow password is valid for 45 days and must be changed afterwards.
• CThe system's host key is used to encrypt all shadow passwords.
• DShadow passwords are always combined with a public key that has to match the user's private
• EShadow passwords are stored in plain text and can be checked for weak passwords.

• A
  78% (28)
• B
  3% (1)
• D
  14% (5)
• E
  6% (2)

Explanation

Shadow passwords improve security by moving password hashes from /etc/passwd (world-readable by all users) to /etc/shadow, which is only readable by root - so regular users cannot access or attempt to crack the hashes offline. This is exactly what option A describes.

Why the distractors are wrong:

• B is false: shadow passwords have no built-in 45-day expiration; password aging is a separate, configurable feature unrelated to the shadow mechanism itself.
• C is false: the host key is used in SSH, not for shadow password encryption; hashes use algorithms like SHA-512 with a random salt.
• D is false: shadow passwords have nothing to do with public/private key pairs; that describes certificate-based or SSH key authentication.
• E is false: shadow passwords are hashed, never stored in plain text - that would be the opposite of a security improvement.

Memory tip: Think of "shadow" as hiding in the dark - the hashes are hidden in the shadows, away from regular users who could otherwise read /etc/passwd and run offline dictionary attacks against the hashes.

No community discussion yet for this question.